Privacy policy

Last change: 11 November 2026

1. Who is responsible

Brightstar Apps is responsible for your data in Avocount (the "controller"). The address is Bucharest, Romania. For each question about your data, write to caltrack@fastmail.com.

2. The data that we keep

• Your account: your email address, a hash of your password (not the password), your time zone, your language, and the dates of the sign up and of the verification.
• Your body values, when you fill in the profile: sex, birth date, height, weight, activity, goal. These are health data.
• What you eat: your entries with their amounts and values, your foods, your daily targets and your meal times. These are health data too.
• Telegram, when you link it: your Telegram user ID and name, the text and the captions of your messages to the bot, what the model read from them (for example the food names and the amounts), and the replies of the bot. We do not keep the photos.
• The text box on the Today page: we keep the entries that it makes, not the text.
• Use: the number of your messages, of the model calls and of the tokens each day, and their cost.
• Technical data: the server log keeps the IP address, the time and the address of each page request, and the errors.

3. Why we use the data

• To run Avocount for you: your account, your entries, your targets and the replies of the bot. The legal basis is our contract with you (GDPR, article 6(1)(b)).
• Your body values and your meals are health data. We process them because you agree to it when you sign up and when you enter them (GDPR, article 9(2)(a)). You can take back your agreement at any time: clear your profile on the Settings page, or delete your account.
• To keep the service safe and to stop abuse: the server log, the limits of the logins and of the messages. The legal basis is our legitimate interest (GDPR, article 6(1)(f)).
• To send the account emails: the verification link, the password reset link, and the notices about a Telegram link and about the delete of your account. We send no advertising.
• To show the website in your language. When you did not select a language, the server finds the country of your IP address in a list on the server (IP Geolocation by DB-IP, CC BY 4.0). From Romania, the website shows Romanian. The IP address does not leave the server, and we keep no record of the country. The legal basis is our legitimate interest (GDPR, article 6(1)(f)).

4. Who gets the data

We do not sell your data. We show no advertising. These companies process data for us:

• Hosting: Hetzner Online GmbH, Germany. The servers are in Germany, in the European Union. All your data is on these servers.
• The language model: OpenAI, in the United States. It gets the text, the caption and the photo of each message that you send to Avocount, and the names and values of the foods that can match. It does not get your email, your name or your body values. The transfer to the United States uses the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses of the European Commission.
• Email: Cakemail, in Canada. It gets your email address and the text of the account emails. The European Commission accepts the data protection of Canada (adequacy decision).
• Telegram, only when you use the bot. Telegram carries your messages. The privacy policy of Telegram applies to Telegram.
• Open Food Facts, a public food database. It gets food names and barcodes, never your personal data.

5. How long we keep the data

• We keep your data until you delete your account. "Delete my account" deletes all your data at once.
• The daily backups keep a copy for up to 10 days. Then the copy is deleted too.
• The server log deletes its oldest lines when it reaches its size limit, usually after a few weeks.
• An account that you do not verify can be deleted after 30 days.

6. Who at Avocount sees your data

The operator sees the list of the accounts and their use on the admin pages: the email, the dates, the number of messages and the cost. The admin pages do not show your meals, your messages or your body values. The operator reads your data only to fix a problem that you report, or when the law requires it.

7. Cookies

Avocount uses two cookies. The session cookie keeps you logged in. Avocount does not work without it. The language cookie keeps the language that you select, also when you are not logged in. It holds only the code of the language, for example "en", and it stays for one year. We use no analytics, no advertising and no tracking cookies.

8. Your rights

You have the right to see, to correct, to delete and to download your data, to limit or to object to its use, and to take back your agreement. Most of this you can do yourself:

• Correct: edit your entries, foods and profile.
• Download: "Export my data" on the Account page gives all your data in one ZIP file.
• Delete: "Delete my account" on the Account page.

For each other request, write to caltrack@fastmail.com. We answer in one month or less.

You can also complain to the data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), Romania, www.dataprotection.ro, or to the authority of the country where you live.

9. Security

Avocount uses HTTPS. It keeps only a strong hash of your password (Argon2id). A new password closes all your other sessions. The limits of the logins stop the guessing of passwords. The tokens of the email links do not go into the log.

10. Age

Avocount is for people of 16 years and older. If we learn that a younger person has an account, we delete it.

11. Changes

If we change this policy, we change the date at the top. For an important change, we tell you by email before it applies.